As of October 22, 2026. Based on official announcements only.

The night the Prime Minister asked everyone on X to “act tonight”

Shortly before 10 p.m. on October 21, 2026, a post appeared on Prime Minister Sanae Takaichi’s X account that looked nothing like her usual political messages.

This is an urgent request that I would like everyone to act on tonight.
Regarding PHP, which is used by many websites, the PHP security team has issued a warning about two critical vulnerabilities.
Please check whether your public websites use PHP, and prepare to apply the security patch, to be released tonight at 11 p.m. Japan time on October 21, as quickly as possible.
If applying the patch quickly is difficult, temporarily taking the website offline is one effective way to reduce the risk.

Source: https://x.com/takaichi_sanae/status/2112890642590564386

It is highly unusual for a prime minister to call for action on a specific software vulnerability, down to the release time of the patch. The National Cybersecurity Office posted the same message, and IPA (Information-technology Promotion Agency, Japan) issued a “request for advance preparation” the same day.

The effect was immediate. Companies large and small announced emergency maintenance, including the online shop builder BASE, Cygames’ game “Umamusume: Pretty Derby,” and childcare services, and some municipal websites went offline temporarily. Engineers welcomed the move, saying that because the Prime Minister spoke, management finally understood the risk (ITmedia NEWS, October 22, 2026, https://www.itmedia.co.jp/news/article/2610/22/2000002483/ ).

The call to action was right, and PHP is the top priority among this month’s issues. But there is one thing I want you to be aware of.

PHP is not the only critical risk that has been officially announced.

In the same week that PHP made headlines, GitLab, Next.js, Windows, nginx, Node.js, Oracle products, Java, Tomcat, MySQL, EC-CUBE, and a WordPress plugin all received critical security updates from their respective vendors. Some of them are officially confirmed to be under active attack.

If you patch PHP and call it a day, the hole next door stays open. This article organizes the 12 issues you should check as of October 22, 2026, based solely on official announcements, with release dates, fixed versions, and links to primary sources.

Not everyone needs to act on all 12. Read this as a checklist to see whether the technologies you or your company use are affected.

Critical Security Risks (October 2026)

The 12 issues at a glance (in priority order)

1. PHP [Released Oct 21] Top priority

What happened
On October 20, the PHP security team announced that a critical fix would be released the next day at 14:00 UTC (11 p.m. Japan time), and it shipped on schedule. The fix covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed “PHP2Shell.” Both are rated 9.2 on CVSS v4.0.

Under certain conditions, an unauthenticated remote attacker can execute arbitrary code on the server. PHP’s advisory states that the risk is highest with mod_php, where a demonstrated exploit shows an unauthenticated request triggering the attack before any application code runs. Every configuration that serves web requests is affected, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

Why it is urgent
The vulnerability details leaked on October 20, before the fix was out, and exploit code began circulating. The security firm Patchstack reported receiving attack reports from hosting partners, and Cloudflare’s CTO said they were seeing early attacks. php.net itself does not mention confirmed breaches, but it states clearly that installing the fixed release is the only complete fix.

Fixed versions
8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

Easy to miss

• PHP 8.1 and older are end-of-life and will not receive a fix. Servers running older PHP need a version upgrade, not a patch.
• If you use WordPress, updating WordPress itself does nothing. The fix is on the server-side PHP. On shared hosting, check whether your provider has updated PHP.
• Linux distributions received the patches in advance, so apt or yum may already have updated packages.

Primary sources

• PHP official https://www.php.net/archive/2026.php#2026-10-21-5
• IPA https://www.ipa.go.jp/security/security-alert/2026/alert20261022.html

2. GitLab [Released Oct 21] Severity 10.0

What happened
GitLab released an emergency patch on October 21. The headline issue is CVE-2026-110264, with the maximum CVSS score of 10.0. By exploiting an integer overflow in the regular expression compiler, an unauthenticated attacker can execute arbitrary code on the GitLab server. The affected range is “all versions since 7.0,” which effectively means every self-managed GitLab instance.

Fixed versions
19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13

Easy to miss
This is the most important point. GitLab had already released another emergency patch for a different CVSS 10.0 issue (CVE-2026-97229) on October 12, and many people updated to 19.4.2 / 19.3.4 / 19.2.8 at that time. That update does not close this vulnerability. You need to update again to the next version up.

GitLab.com is already patched and requires no action from users. GitLab Dedicated is also covered.

Primary sources

• GitLab official https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

3. Next.js [Released Oct 14] Severity 9.5 ×2

What happened
Vercel shipped an out-of-band security update on October 14. There are two vulnerabilities rated 9.5.

The first is in App Router with Cache Components: when a use cache function returns multiple typed arrays, it can lead to unauthenticated remote code execution. Vercel urges everyone to upgrade immediately even if their application has no such functions.

The second is in the Image Optimization API when processing SVG: a flaw in the upstream librsvg library can lead to remote code execution (CVE-2026-96889). This affects deployments on glibc-based Linux.

A high-severity denial-of-service issue was also fixed, where crafted requests to apps using Server Actions can monopolize the CPU.

Fixed versions
16.4.1 / 15.5.28

Easy to miss

• Even after updating Next.js, if your lockfile pins sharp to the 0.34 series, the vulnerable image decoder remains. Make sure sharp is 0.35.5 or later.
• As of October 15, the use cache and Server Actions issues had no CVE assigned, so dependency scanners such as npm audit may not detect them.
• JPCERT/CC has confirmed that proof-of-concept code for CVE-2026-96889 is publicly available.

Primary sources

• Next.js official https://nextjs.org/blog/nextjs-security-update-october-14-2026

4. Windows [Released Oct 14 (Oct 13 US time)] Zero-day under active exploitation

What happened
Microsoft’s October Patch Tuesday was the largest ever, with more than 1,400 fixes. Among them is CVE-2026-96951, a security feature bypass in Windows Shell, which Microsoft itself confirms was exploited as a zero-day before the fix.

The flaw bypasses the “Mark of the Web” protection applied to files downloaded from the internet, and is used in attacks that trick users into opening crafted files sent by email or messaging. CVSS is 8.8. User interaction is required, but no prior privileges are needed.

IPA issued an “emergency” alert, and the US CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.

What to do
Apply Windows Update. It usually installs automatically, but if your company manages updates centrally, push them out early.

Primary sources

• IPA https://www.ipa.go.jp/security/security-alert/2026/1014-ms.html
• MSRC https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951

5. nginx [Released Oct 14]

What happened
F5 issued an out-of-band security notification for the nginx product family on October 14, fixing 11 vulnerabilities in total. F5 rates three of them (CVE-2026-15176 / CVE-2026-97205 / CVE-2026-93479) at 9.2 on CVSS v4.0.

They are, respectively, a heap overflow in alias and rewrite handling, a use-after-free in asynchronous file I/O (AIO) and SSI, and a heap overflow in the map directive. The main impact is a worker process crash (denial of service), with remote code execution possible when ASLR is disabled or bypassed.

Fixed versions
nginx Open Source 1.30.6 / 1.31.7 (NGINX Plus R33 to R37, Ingress Controller, Gateway Fabric, and others are also affected)

Easy to miss

• The upstream nginx project (nginx.org) rates these three as “Medium,” a gap from F5’s 9.2. If you do not use the affected configurations, you are not impacted.
• If you cannot update right away, the suggested mitigations are: avoid alias and $request_filename inside location blocks, disable AIO or SSI, and use named captures in map.

Primary sources

• nginx official https://nginx.org/en/security_advisories.html
• F5 https://my.f5.com/manage/s/article/K000163408

6. Node.js [Released Oct 21]

What happened
Node.js released security fixes on October 21, the same day as PHP. There are 10 issues in total: 4 High, 3 Medium, and 3 Low.

The most serious of the High issues is an out-of-bounds write in the Brotli decoder (CVE-2026-111497), which can lead to memory leaks or arbitrary code execution in any process that decompresses attacker-supplied Brotli data. The others are two TLS certificate hostname verification bypasses using variant IP address notation, and one issue where dns.resolve truncates names at a NUL character.

Fixed versions
26.12.1 / 24.22.1 / 22.23.4

Easy to miss

• Node.js 20 and 25 are end-of-life and will not receive fixes.
• The same release also includes a CA certificate update in response to the eMudhra certificate authority incident.
• Anyone using Node.js for AI tools, web apps, or automation scripts should check. Ordinary website visitors do not all need to update.

Primary sources

• Node.js official https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

7. Oracle products [Released Oct 20]

What happened
Oracle published its quarterly Critical Patch Update on October 20. It is the last scheduled update of the year and a large one: 1,295 patches covering 1,209 CVEs. Six vulnerabilities are rated CVSS 10.0, the most urgent being in the E-Business Suite Workflow Notification Mailer (CVE-2026-101809).

The update spans 33 product families, including Database, Fusion Middleware, E-Business Suite, GoldenGate, and communications products.

Easy to miss
Not every Oracle product carries the same risk. Search the advisory for the product names you actually use, and check only the relevant patches.

Primary sources

• Oracle official https://www.oracle.com/security-alerts/cpuoct2026.html
• Oracle Security Blog https://blogs.oracle.com/security/october-2026-critical-patch-update-released

8. Java SE [Oracle release Oct 20, IPA alert Oct 21]

What happened
The Oracle CPU above includes fixes for Java SE, and IPA issued an alert the following day, October 21. If exploited, these flaws could crash applications or allow an attacker to take control of the PC.

Affected versions
Java SE 27 / 26.0.2 / 25.0.4.1 / 21.0.12.1 / 17.0.20.1 / 11.0.32.1 / 8 Update 503 and earlier

Easy to miss
If you manage business systems, internal tools, or servers that run Java, check the version in use. For commercial use, Oracle Java’s licensing changed for releases after April 2019, so IPA also recommends considering paid support.

Primary sources

• IPA https://www.ipa.go.jp/security/security-alert/2026/1021-jre.html

9. Apache Tomcat [Released Oct 20]

What happened
Apache Tomcat disclosed seven vulnerabilities on October 20: three rated “Important” and four rated “Low.”

The three Important issues are: authentication without the correct password when JNDIRealm uses certain SASL mechanisms (CVE-2026-101296); requests and responses getting mixed between users over HTTP/2 after an error in asynchronous processing (CVE-2026-101356); and response bodies leaking into the next request on the AJP connector during large non-blocking writes (CVE-2026-103119).

Fixed versions
11.0.27 / 10.1.61 / 9.0.123

Easy to miss
The authentication bypass is limited to specific JNDIRealm configurations and does not apply to every Tomcat installation. The impact depends on your branch and configuration, so compare your setup against the official page.

Primary sources

• Apache Tomcat official https://tomcat.apache.org/security-11.html

10. MySQL [Released Oct 20]

What happened
MySQL 8.4.13 was released on October 20. The “Security Notes” section of the release notes lists three items: handling of the server-supplied RSA public key in SHA-2 authentication, parsing of WebAuthn challenge packets, and argument handling in an audit API function. In addition, there are many input validation fixes, including authentication packet validation, LOAD XML CDATA validation, binary JSON validation, and replication protocol packet validation.

Easy to miss
The release notes themselves do not list CVE numbers. Check the MySQL section of the Oracle CPU for the CVE mapping. If you use a managed cloud database such as RDS, checking your provider’s status is enough.

Primary sources

• MySQL official https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html

11. EC-CUBE Amazon Pay plugin [Released Oct 14] Attacks confirmed

What happened
A vulnerability (CVE-2026-103671) was found in the official “Amazon Pay plugin” for EC-CUBE 4, a Japanese e-commerce platform, that allows external control of web parameters that should not be modifiable. It was published on JVN on October 14. During checkout, users can be redirected to a fake site and have their account information stolen.

The CVSS score is 5.3 (Medium), which is not high, but the developer has already confirmed real attacks. Take the fact that it is already being targeted more seriously than the number.

What to do
Update to the latest CV2 version. CV1 versions 1.2.9 and earlier cannot be upgraded to the fixed release, so the vendor recommends migrating to CV2.

Primary sources

• JVN https://jvn.jp/jp/JVN43511918/

12. WordPress Bricksforge plugin [Released Oct 8] Under active exploitation

What happened
A vulnerability (CVE-2026-85097) was found in “Bricksforge,” an extension plugin for the Bricks builder on WordPress, that allows unauthenticated attackers to upload arbitrary files and execute PHP. Patchstack disclosed it on October 8 with the maximum severity of 10.0. Attacks were observed as early as October 7 and continue from multiple source IPs.

Fixed versions
3.1.8.10 or later, or the 4.x series

Easy to miss
WordPress site operators should check the server-side PHP from item 1 regardless of whether they use this plugin. Updating the plugin is pointless if PHP is still outdated.

Primary sources

• Patchstack https://patchstack.com/articles/

In what order should you respond?

Twelve items can feel overwhelming, but the priorities are clear.

Right now (already being exploited)
Windows, WordPress Bricksforge, and the EC-CUBE Amazon Pay plugin. The vendor or developer has confirmed exploitation.

Today (unauthenticated code execution, with exploit code circulating)
PHP, GitLab, and Next.js. PHP’s details have leaked, JPCERT has confirmed a public PoC for Next.js, and GitLab is a 10.0 affecting every version.

Planned (schedule the update)
nginx, Node.js, Oracle products, Java, Tomcat, and MySQL. None have reported exploitation yet, and many depend on specific configurations or use cases.

What operators should and should not do

If you run a website or application

1. Identify the technologies and versions you use (PHP, Node.js, nginx, database, frameworks, plugins)
2. Compare them against the official URLs above
3. Take a backup
4. Apply the fixes. If you cannot do so right away, taking the site offline temporarily is an option, as the Prime Minister’s post noted
5. After updating, verify that everything works and review the logs. For the three items “under active exploitation,” also check whether you were compromised before the update

If you are an ordinary user (someone who only browses websites)

• Do not open suspicious update emails or links. Phishing disguised as “PHP vulnerability response” would not be surprising
• Check the official websites and notices of the services you use
• Do not try to operate servers you do not manage
• If you use Windows, at least apply Windows Update (item 4)

Closing thoughts

It is a good thing that the Prime Minister’s post made the “PHP vulnerability” widely known. Management understood the risk, and work that engineers would normally spend days persuading people to do got done overnight.

But vulnerabilities do not arrive one at a time. On October 21, the day the PHP patch came out, GitLab and Node.js also shipped fixes. The week before, it was Windows, nginx, and Next.js, and before that, a WordPress plugin. The size of the headlines does not necessarily match the level of danger to your environment.

What matters is not being swept along by the news, but understanding the environment you are running. A vulnerability being published is not the same as your site already being attacked. Calmly compare the list against your own setup.

This article is based on official announcements as of October 22, 2026. The situation changes daily, so check the following pages for the latest information.

• IPA Important Security Information https://www.ipa.go.jp/security/security-alert/2026/index.html
• JPCERT/CC https://www.jpcert.or.jp/
• JVN https://jvn.jp/

If you don’t know what your own environment looks like

After reading this far, some of you may be thinking, “Nobody at our company knows whether our website runs on PHP or nginx in the first place.” The companies that struggled most this time were not the ones with engineers, but the ones with no IT staff at all, or a single person juggling IT alongside another job.

If you are a Japanese company operating in Vietnam and this sounds familiar, consider the IT support service from ALLEXCEED VIETNAM.

ALLEXCEED VIETNAM IT Support
https://allexceed.com.vn/it-support/

• Outsourced IT administration: We take on the full set of tasks described in this article, from inventorying your technologies and versions, to checking them against vulnerability advisories, applying fixes, and verifying after updates
• Ask us anything IT: We also handle everyday questions such as “Is it safe to open this email?” or “Who updates PHP on our shared hosting?”
• Generative AI adoption and small tool development: The same team can help with business improvement, not just security
• Japanese and Vietnamese support, zero time difference: Communicate in Japanese during Vietnam business hours
• Monthly subscription (quasi-delegation contract): Plans from 5 to 15 hours per month, starting at USD 166 per month. Suited to companies that do not need a full-time IT hire but want someone to turn to
• Track record: Over 20 years building systems for Japanese companies, more than 850 projects, and a team of about 70 engineers

We offer a free 30-minute consultation. It is fine to start from “we don’t know which of these 12 items apply to us.” Let’s begin by understanding where you stand.

• Free consultation and contact: https://allexceed.com.vn/contact/

References and primary sources